5 ms·

Fix the cars. A brand new $60,000 car shouldn’t be so simple to swipe. They probably spent less time stealing my neighbors car than he did waiting on the cred

Fix the cars. A brand new $60,000 car shouldn’t be so simple to swipe. They probably spent less time stealing my neighbors car than he did waiting on the credit check to buy the car lol… it’s crazy these days with cars.

newsclues 3y ago
Cars are computers now. What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. No level of technology will stop this. But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.
- caskstrength 3y ago
  > What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. Can you hack and own my fully patched Pixel phone? Or my GF's iPhone? Sure, sophisticated state-sponsored actors can sometimes do it by burning several million dollars worth of 0days in the process, but some two-digit IQ riff-raffs? Probably not so much. EDIT: just to be clear - by "two-digit IQ riff-raff" I meant OP's neighborhood car thieves, not you :)
  - eertami 3y ago
    Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks. A lot of damage can be done and things successfully owned without needing to hack or exploit the device (car/phone).
    - caskstrength 3y ago
      > Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks. You have any reference regarding how prevalent that is? Everyone I know switched to biometrics a decade ago.
  - newsclues 3y ago
    This is done by organized crime with engineers on staff. Sure it’s drug addicts stealing cars but the people shipping them are smart and have access to capital.
    - caskstrength 3y ago
      I agree, but that brings us back to my original question: why can't same smart organized crime people unlock my smartphone then? Because Apple/Google give a damn about security and car manufacturers do not.
      - ryandrake 3y ago
        Also: When your phone or computer is hacked, most people think "Wow, the device is flawed." But when your car gets stolen, most people think "Wow, we should stop those criminals." Apple/Google are incentivized to give a damn about security because incidents reflects poorly on their products. We need to start making thefts via security exploits reflect poorly on the car manufacturers and their products.
      - newsclues 3y ago
        Economic incentives. People will buy a $150,000 SUV for 50k and they can still make money. Phones have less incentive and Apple is going to be better at bricking the phones than carmakers will.
      - saint_fiasco 3y ago
        Apple and Google don't sell insecure cheap phones, but lots of other manufacturers do. I suppose organized crime doesn't systematically take advantage of that because cheap phones are cheap, and the people who own them are poor. You don't get that much benefit from pwning them. Alternatively, maybe organized crime does take advantage of them but we haven't heard about it. They could have a giant botnet of them for all we know.
      - fullspectrumdev 3y ago
        a couple of years ago it wasn’t uncommon for victims of phone theft in the UK to end up flooded with iCloud phishing messages to try gain access to their iCloud account and unblock the device so it wasn’t totally worthless for resale. I still see a lot of iCloud phishing messages, but also understand that Apple has made this vector harder.
- acdha 3y ago
  > What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. It’s not the 2000s any more. Even national security agencies have trouble with phone decryption, and that suggests a path forward for cars using a tamper-resistant secure element since car thieves won’t spend more money attacking something than they can resell it for. Cars need service regularly you can have a way to replace a damaged SE which is more restricted so a legitimate owner can regain control of their stolen property - if you required, say, a government photo ID check for the owner on the title to reset the encryption keys, car thieves are highly unlikely to spend time getting high-quality fake ID since the odds of getting caught would go up dramatically, and you could deter shady auto shops by requiring them to submit proof of their ID verification for that service.
  - newsclues 3y ago
    They get exported overseas and any technology lock or security device gets ripped out and replaced. This isn’t about extracting encrypted data, but bypassing systems to start a car.
    - acdha 3y ago
      Yes, because the current design is lax. Now think about what happens if the engine computer won’t start with a bad signature or the entertainment system won’t work. How would that affect the overseas market?
      - newsclues 3y ago
        The part that requires a signature will be taken out and replaced. Infotainment systems will get gutted and replaced with aftermarket ones.
        acdha 3y ago
        Again, all of those lower the value to the thieves. If they need to create a custom engine controller, they’re going to need to pay a lot more than the $0 they currently spend. If they need to replace the entertainment system, the cost of doing so will cut into their margin. Don’t make the mistake of thinking that a system needs to be perfect to be worthwhile.
- eertami 3y ago
  > No level of technology will stop this. Except for you know, the technology of a physical car keys and an immobilizer. There's a reason it's the keyless entry start/stop button cars that are being targeted by thieves, it's simply so much easier. The frustrating thing is that new cars are being produced that _only_ offer keyless entry, and so eventually the choice is taken away or you have to drive a very old car.
- Levitz 3y ago
  The level of technology that stops this is cars not being computers. Every piece of tech has tradeoffs, and for cars this one is just not worth it.
  - HeyLaughingBoy 3y ago
    What are you proposing? That we go back to being able to turn the ignition switch with a screwdriver?
- rjmunro 3y ago
  > No level of technology will stop this. Why does no one steal Teslas?
  - newsclues 3y ago
    Think about where these cars end up, it’s not near a service centre.
- BrandoElFollito 3y ago
  > What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. You are damn good then :) One can protect against such that's by using well placed cryptography.
- HeyLaughingBoy 3y ago
  > No level of technology will stop this. Tell that to the FDA. I work in medical devices. It's no longer sufficient to throw up your hands and assume "well, they have their hands on the device, we can't stop them from doing anything." The new cybersecurity guidance anticipates an attacker having physical access to your Device and you are expected to understand and mitigate any impact that can have. Cars shouldn't be any different.
  - saint_fiasco 3y ago
    I'd bite that bullet. The FDA should be less strict with their cybersecurity stuff. The amount of lives lost to the increased cost of care is not worth the increase in cybersecurity. If medical devices have just enough security to stop people who don't have physical access to the device, just enough to make attacks at scale unfeasible, then that should be good enough IMO.
nemo44x 3y ago
Or make grand theft auto an offense that is actually prosecuted. Make hard penalties for violating another citizens by stealing their property. Start with 5 year minimums off the bat and every offense afterwards adds another 5 years. You'll see car theft plummet.

newsclues 3y ago

Cars are computers now. What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. No level of technology will stop this. But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.

caskstrength 3y ago
> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. Can you hack and own my fully patched Pixel phone? Or my GF's iPhone? Sure, sophisticated state-sponsored actors can sometimes do it by burning several million dollars worth of 0days in the process, but some two-digit IQ riff-raffs? Probably not so much. EDIT: just to be clear - by "two-digit IQ riff-raff" I meant OP's neighborhood car thieves, not you :)
- eertami 3y ago
  Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks. A lot of damage can be done and things successfully owned without needing to hack or exploit the device (car/phone).
  - caskstrength 3y ago
    > Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks. You have any reference regarding how prevalent that is? Everyone I know switched to biometrics a decade ago.
- newsclues 3y ago
  This is done by organized crime with engineers on staff. Sure it’s drug addicts stealing cars but the people shipping them are smart and have access to capital.
  - caskstrength 3y ago
    I agree, but that brings us back to my original question: why can't same smart organized crime people unlock my smartphone then? Because Apple/Google give a damn about security and car manufacturers do not.
    - ryandrake 3y ago
      Also: When your phone or computer is hacked, most people think "Wow, the device is flawed." But when your car gets stolen, most people think "Wow, we should stop those criminals." Apple/Google are incentivized to give a damn about security because incidents reflects poorly on their products. We need to start making thefts via security exploits reflect poorly on the car manufacturers and their products.
    - newsclues 3y ago
      Economic incentives. People will buy a $150,000 SUV for 50k and they can still make money. Phones have less incentive and Apple is going to be better at bricking the phones than carmakers will.
    - saint_fiasco 3y ago
      Apple and Google don't sell insecure cheap phones, but lots of other manufacturers do. I suppose organized crime doesn't systematically take advantage of that because cheap phones are cheap, and the people who own them are poor. You don't get that much benefit from pwning them. Alternatively, maybe organized crime does take advantage of them but we haven't heard about it. They could have a giant botnet of them for all we know.
    - fullspectrumdev 3y ago
      a couple of years ago it wasn’t uncommon for victims of phone theft in the UK to end up flooded with iCloud phishing messages to try gain access to their iCloud account and unblock the device so it wasn’t totally worthless for resale. I still see a lot of iCloud phishing messages, but also understand that Apple has made this vector harder.
acdha 3y ago
> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. It’s not the 2000s any more. Even national security agencies have trouble with phone decryption, and that suggests a path forward for cars using a tamper-resistant secure element since car thieves won’t spend more money attacking something than they can resell it for. Cars need service regularly you can have a way to replace a damaged SE which is more restricted so a legitimate owner can regain control of their stolen property - if you required, say, a government photo ID check for the owner on the title to reset the encryption keys, car thieves are highly unlikely to spend time getting high-quality fake ID since the odds of getting caught would go up dramatically, and you could deter shady auto shops by requiring them to submit proof of their ID verification for that service.
- newsclues 3y ago
  They get exported overseas and any technology lock or security device gets ripped out and replaced. This isn’t about extracting encrypted data, but bypassing systems to start a car.
  - acdha 3y ago
    Yes, because the current design is lax. Now think about what happens if the engine computer won’t start with a bad signature or the entertainment system won’t work. How would that affect the overseas market?
    - newsclues 3y ago
      The part that requires a signature will be taken out and replaced. Infotainment systems will get gutted and replaced with aftermarket ones.
      - acdha 3y ago
        Again, all of those lower the value to the thieves. If they need to create a custom engine controller, they’re going to need to pay a lot more than the $0 they currently spend. If they need to replace the entertainment system, the cost of doing so will cut into their margin. Don’t make the mistake of thinking that a system needs to be perfect to be worthwhile.
eertami 3y ago
> No level of technology will stop this. Except for you know, the technology of a physical car keys and an immobilizer. There's a reason it's the keyless entry start/stop button cars that are being targeted by thieves, it's simply so much easier. The frustrating thing is that new cars are being produced that _only_ offer keyless entry, and so eventually the choice is taken away or you have to drive a very old car.
Levitz 3y ago
The level of technology that stops this is cars not being computers. Every piece of tech has tradeoffs, and for cars this one is just not worth it.
- HeyLaughingBoy 3y ago
  What are you proposing? That we go back to being able to turn the ignition switch with a screwdriver?
rjmunro 3y ago
> No level of technology will stop this. Why does no one steal Teslas?
- newsclues 3y ago
  Think about where these cars end up, it’s not near a service centre.
BrandoElFollito 3y ago
> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. You are damn good then :) One can protect against such that's by using well placed cryptography.
HeyLaughingBoy 3y ago
> No level of technology will stop this. Tell that to the FDA. I work in medical devices. It's no longer sufficient to throw up your hands and assume "well, they have their hands on the device, we can't stop them from doing anything." The new cybersecurity guidance anticipates an attacker having physical access to your Device and you are expected to understand and mitigate any impact that can have. Cars shouldn't be any different.
- saint_fiasco 3y ago
  I'd bite that bullet. The FDA should be less strict with their cybersecurity stuff. The amount of lives lost to the increased cost of care is not worth the increase in cybersecurity. If medical devices have just enough security to stop people who don't have physical access to the device, just enough to make attacks at scale unfeasible, then that should be good enough IMO.

nemo44x 3y ago

Or make grand theft auto an offense that is actually prosecuted. Make hard penalties for violating another citizens by stealing their property. Start with 5 year minimums off the bat and every offense afterwards adds another 5 years. You'll see car theft plummet.